What does human in the loop mean for AI?

Human in the loop means that an AI system's work stops at a set point and waits for a person, who can approve it, change it or reject it before anything happens. The person takes part in the process: without their decision the step does not go ahead. For an AI worker in a business, it is the rule that says which actions the worker may prepare but only a named person may release.

What is the difference between in the loop, on the loop and out of the loop?

• Human in the loop. The action waits for a person's approval each time.

• Human on the loop. The action goes ahead on its own; a person watches the results and can step in or stop it.

• Human out of the loop. The system acts and nobody reviews it.

No business process is all one of these. Filing an attachment against the right record can safely be on the loop. An email to a client about their own circumstances belongs in the loop. So the useful question is which actions wait, for which person, and at what moment.

What does UK law say about decisions made without a person?

The phrase is not a legal term, but UK data protection law has a close relation. Under Article 22A of the UK GDPR, which applies across the UK, a decision is "based solely on automated processing" if there is no meaningful human involvement in the taking of the decision. A "significant decision" is one that produces a legal effect for the person it is about, or a similarly significant effect. Where a significant decision that is based entirely or partly on personal data is taken solely by automated processing, Article 22C requires the controller to have safeguards in place: the person must be given information about the decision and be able to make representations, obtain human intervention and contest it.

The Information Commission's Office has published guidance on what meaningful involvement looks like. It is published as draft guidance, updated on 31 March 2026, and its public consultation closed on 29 May 2026, so the final wording may change. As drafted, it says the person should review the decision at a point where the outcome can still be changed, have the authority and discretion to alter it, be suitably trained and qualified to understand the system's logic, outputs, limitations and risks, and take into account the information the decision was based on. It adds that this should happen before the decision is applied to anyone, and every time, not as a spot check.

That is a description of the duty, not advice on meeting it. How it applies to your business depends on the decisions you make about people and is a question for your own data protection adviser.

What does human in the loop look like in a working day?

Take a letting agency and tenant referencing. An AI worker gathers each applicant's references into one file, says what is still missing, and stops there. The decision to let is the lettings manager's, and so is what to do about a borderline reference. The ICO's draft guidance lists access to housing among the effects to consider when judging whether a decision is significant, and the worker's role is written so that it reports and never decides.

The approval itself can be small. The worker shows what it proposes to do, the evidence it is working from and the choice: confirm or cancel. For a reminder to a guarantor that is the draft beside the application it refers to; for the finished file it is every reference, open to read, with the gaps listed first. The person decides in the place they already work, and the decision is recorded with their name in the audit trail.

Not every step needs it. A business can give a standing instruction for routine work, such as reminders in wording approved in advance or records updated from a document the client has supplied. Anything outside the instruction still waits. Which steps wait and which do not is agreed when the role is specified. Our homepage puts the same split in six words: "It drafts. You approve. We manage."

What makes an approval real?

A person clicking "confirm" forty times in a row without reading is in the loop on paper only. Four things separate real oversight from a rubber stamp.

1. The evidence is in front of them. The approver sees the source document or record beside the proposal, not just the proposal.

2. They can change it. Editing or rejecting is as easy as approving, and nothing has already gone out.

3. They are the right person. The approver has the authority and the knowledge for that decision.

4. The volume is humane. Routine items are covered by standing instructions so that the approvals left are few enough to read.

What is human in the loop confused with?

• Supervision after the event. A monthly review of what the system did is valuable, but it puts a person on the loop, not in it.

• Guardrails. Guardrails are limits the system cannot cross whoever approves.

What always stays with a person?

Some things are never delegated, standing instruction or not: a decision a regulator expects a named individual to make, advice to a client, accepting or refusing a customer, tenant or candidate, spending above an agreed limit, any reply to a complaint and any telephone call. For these an AI worker gathers the evidence and hands it over. In a firm regulated by the Financial Conduct Authority it does not draft the advice either: the adviser advises, and the worker does the paperwork around it.

The role would be written with you, naming the actions that wait for your approval and the decisions that never leave your people. If you would like to see where that line falls in one job of yours before anything is built, talk to our agent.